The Cyber Insurance Claim Is Won in the First 48 Hours (Not in the Policy Negotiation)

I have read two claim files this year that tell the whole story. One paid at day 34. One paid two-thirds, after four weeks of arguing. Same strain of ransomware, similar revenue, similar policies. The difference was not coverage. It was the order of operations in the first 48 hours.

Here is the reframe: the claim is not an essay you write after the incident. It is a file you open in hour one and build in a fixed order, while the fix clock runs in parallel.

---

The claim file, in order

1. The policy packet, assembled in peacetime. Declarations page, endorsements, the notice requirement verbatim, the panel counsel and vendor list, the broker's mobile, the carrier's 24/7 line — one folder, reviewed twenty minutes at every renewal. A policy nobody can find at 2am is a policy you will notice late.
2. Notice, inside the policy clock. "As soon as practicable" means hours, not weeks. Notice is not a confession; it opens the claim number and unlocks the panel. Log who you spoke to and when.
3. Approved counsel first, then panel forensics. Panel vendors are the reimbursed vendors. The invoice from your favorite unapproved firm is the most expensive invoice you will ever pay twice.
4. Evidence preservation before any fix. Disk images, log exports, the ransom note as-is, extortion contact routed through counsel, and a chain-of-custody table. The fastest restore in the world is second place to a defensible picture of what happened.
5. The cost ledger, opened in hour one. One row per cost from the first hour: timestamp, category, amount, receipt, pre-approval status. The ledger is the claim. Reconstructing spend from card statements in week three loses the overtime and the credibility.
6. Insurer before customers. Many policies require consent for public statements. The notification map and the claim file share a first call — make it once, to the broker.
7. Business interruption against a baseline. Lost revenue is claimable against the last twelve months by week — exported during the incident, because the billing system that proves your normal month may be the system that is down.
8. Cooperation duties. No liability admissions, no written speculation about cause, preserve what the attacker touched.
9. The remediation story. The claim closes with evidence: fix tickets, restore-drill timestamp, MFA coverage, retest. You are writing next year's premium with that file.

The five traps

• The policy in a founder's inbox — the notice clock starts at awareness, not when someone finds the PDF.
• Fixing before forensics — re-image the box and the adjuster has nothing to adjust.
• The unapproved vendor invoice — $30k engaged without panel approval, reimbursed at $0. One call in hour one makes the same invoice covered.
• Receipts with no ledger — a shoebox of screenshots is not a claim.
• Silence until "we know more" — notice requires promptness, not certainty. A day-30 first call is a legal problem before it is a coverage one.

The 02:14 Saturday

An eleven-person logistics SaaS wakes to ransomware: two encrypted production hosts, a ransom note. The rerun: broker call at 06:00 same morning, panel counsel by 09:00, panel forensics imaging by noon, ledger row one by 13:00, extortion contact through counsel only, restored from the Friday backup by Wednesday, revenue baseline exported Monday. Claim: $38k forensics and counsel, $9k notification and monitoring, $21k business interruption against a documented baseline — paid at day 34 with one adjuster question, answered from the ledger.

The neighboring agency that hit the same strain fixed everything by Sunday, filed on day 30 from card statements, hired their own firm — and recovered two-thirds. Same policy market. Different hour one.

The metrics that prove the loop

Hours from awareness to notice (same business day, always inside the clock); cost-ledger coverage within seven days (under 100% and you are donating money); panel-vendor share of incident spend; claim cycle time with every reduction reason logged; and a restore drill on record inside the policy year — the restore evidence is both the claim's backbone and next renewal's discount argument.

The full checklist — the nine-row claim file, the chain-of-custody table, the ledger schema, and the traps with rewrites — lives here: Cyber insurance claim checklist for small teams. Pair it with the data breach notification map (same first call, different clock) and the ransomware recovery checklist (the fix track that runs in parallel).

If you want the whole incident stack on paper, the HIVE80lab Ops Starter Kit covers the first 30 minutes, and the Mega Bundle is all five kits in one download.